>A technical criticism of PGP/GPG is of course also possible. The whole thing is a museum of early 1990s crypto, with default ciphers like CAST5 and messages not being authenticated - and even if the message is authenticated most parts of the PGP protocol are not, meaning that you got that big bunch of C code maintained by that one German guy over there that parses unauthenticated bytes that you shipped through half the internet with a big neon-red sticker on it saying "I'M PGP PLEASE TAMPER WITH ME".
Honestly, this made me laugh.
But it also makes me think. GPG and PGP are ancient pieces of somehow working code that probably should not be allowed to operate any significant parts of human communication.
IMO we should aim for a Crypto like Signal presents it; simple yet secure enough for most users.
It might be worthwhile to bring Signal (or atleast the idea) to other protocols like E-Mail.
> It might be worthwhile to bring Signal (or at least the idea) to other protocols like E-Mail.
I'm glad to see someone else thinking the same way as me on this! I got myself an idea for Yet Another Secure Messaging App a while back. After a little market research, I kinda decided, well, everything that I want to do can already be done by PGP, or Signal, or Whisper... except that where they are easy to use, they don't integrate with e-mail, and where the integrate with e-mail, they are not easy to use. So, there's still room for more diversity in the market of providing easy-to-use secure, verifiable messaging, especially without trying to replace e-mail wholesale like so many messaging platforms (secure and otherwise) do. And maybe I'll actually get around to building it someday.
The easy part is the crypto, that's been done to death and back.
Signal has managed to do the "How can we exchange keys while atleast one of us is always offline?" part. So a good and somewhat PFS key exchange should be possible too.
Integrating that seamlessly with email is gonna be hard and require a service to register emails or domains that support the new protocol. Otherwise you end up with the PGP situation.
One want people's mail to automagically encrypt when both have it. Automagically is the best security there is for Joe Average. On the big list of security problems you face for Jane Average, "Werks Automagically" is Point 1 written in golden ink by the pope himself in 72pt fontsize and "Secure against State Adversaries" is Point 2 written in silver by the pope's cat on the second page in 16pt fontsize.
One might also want to introduce a benefit, like disabling it for spammers by having some kind of verification (Phone Number or something?) and heavily police HTML formatting so that little Green Icon next the email means more than "this one spent 30 seconds to find a large prime pair" and more like "this email is probably safe to open, nobody will track you and nobody is going to sell you fake viagra".
People should want to use it, not have to use it to be secure or something.
But as you said, that all requires work and 99% of my time I personally like being unproductive, so I guess it'll never happen.
Honestly, this made me laugh.
But it also makes me think. GPG and PGP are ancient pieces of somehow working code that probably should not be allowed to operate any significant parts of human communication.
IMO we should aim for a Crypto like Signal presents it; simple yet secure enough for most users.
It might be worthwhile to bring Signal (or atleast the idea) to other protocols like E-Mail.